settings updates

Modules/Helpdesk/Policies/TicketPolicy.php

@@ -16,9 +16,16 @@ final class TicketPolicy
 
     public function view(User $user, Ticket $ticket): bool
     {
-        return $this->isPrivileged($user)
-            || ($user->isHelpdeskAgent() && ((int) $ticket->agent_id === (int) $user->id || (int) $ticket->user_id === (int) $user->id))
-            || (int) $ticket->user_id === (int) $user->id;
+        if ($this->isHelpdeskAdmin($user)) {
+            return true;
+        }
+
+        if ($this->isHelpdeskAgent($user)) {
+            return (int) $ticket->agent_id === (int) $user->id
+                || (int) $ticket->user_id === (int) $user->id;
+        }
+
+        return (int) $ticket->user_id === (int) $user->id;
     }
 
     public function create(User $user): bool
@@ -26,10 +33,29 @@ final class TicketPolicy
         return true;
     }
 
+    /**
+     * Helpdesk workflow updates.
+     *
+     * Admins can update every Helpdesk ticket.
+     *
+     * Agents can update any ticket that is visible to them under the Helpdesk
+     * visibility rules. This is important for Kanban drag/drop: a card must
+     * never be displayed as movable and then fail authorization on drop.
+     *
+     * Normal requesters cannot change workflow/status/assignment data.
+     */
     public function update(User $user, Ticket $ticket): bool
     {
-        return $this->isPrivileged($user)
-            || ($user->isHelpdeskAgent() && (int) $ticket->agent_id === (int) $user->id);
+        if ($this->isHelpdeskAdmin($user)) {
+            return true;
+        }
+
+        if (! $this->isHelpdeskAgent($user)) {
+            return false;
+        }
+
+        return (int) $ticket->agent_id === (int) $user->id
+            || (int) $ticket->user_id === (int) $user->id;
     }
 
     public function comment(User $user, Ticket $ticket): bool
@@ -39,11 +65,36 @@ final class TicketPolicy
 
     public function delete(User $user, Ticket $ticket): bool
     {
-        return $this->isPrivileged($user);
+        return $this->isHelpdeskAdmin($user);
     }
 
-    private function isPrivileged(User $user): bool
+    private function isHelpdeskAdmin(User $user): bool
     {
-        return $user->isHelpdeskAdmin();
+        if (method_exists($user, 'isHelpdeskAdmin')) {
+            return $user->isHelpdeskAdmin();
+        }
+
+        if ((bool) ($user->helpdesk_admin ?? false)) {
+            return true;
+        }
+
+        if (method_exists($user, 'isAdmin')) {
+            return $user->isAdmin();
+        }
+
+        if (method_exists($user, 'isMpbaPlatformAdmin')) {
+            return $user->isMpbaPlatformAdmin();
+        }
+
+        return false;
+    }
+
+    private function isHelpdeskAgent(User $user): bool
+    {
+        if (method_exists($user, 'isHelpdeskAgent')) {
+            return $user->isHelpdeskAgent();
+        }
+
+        return (bool) ($user->helpdesk_agent ?? false);
     }
 }